TA558 group targets Hospitality, Hotel, and Travel Organizations

A financially motivated cybercrime group under the name TA558 has been linked to an ongoing wave of attacks aimed at hospitality, hotel, and travel organizations in Latin America with the goal of installing malware on compromised systems.

Phishing campaigns mounted by the group involve sending malicious spam messages with reservation-themed lures such as hotel bookings that contain weaponized documents or URLs in a bid to entice unwitting users into installing trojans capable of reconnaissance, data theft, and distribution of follow-on payloads.

This group has used consistent tactics, techniques, and procedures to attempt to install a variety of malware. The group has been operational at a higher tempo in 2022 than usual, with intrusions mainly geared towards Portuguese and Spanish speakers in Latin America, and to a lesser extent in Western Europe and North America.

The group carried out 51 campaigns so far this year, of which 27 are said to have incorporated URLs pointing to ISO files and ZIP archives, in comparison to just five campaigns altogether from 2018 through 2021.

The researchers said, “The malware used by TA558 can steal data including hotel customer user and credit card data, allow lateral movement, and deliver follow-on payloads. Activity conducted by this actor could lead to data theft of both corporate and customer data, as well as potential financial losses.”